- Added JSDoc comments to `NostrClient` class and methods.
- Added JSDoc comments to `EventsCacheStore`.
- Created `docs/nostr-client-overview.md` with high-level documentation.
- Fixed a race condition in `tests/nostr-delete-flow.test.mjs`.
- Added `scripts/agent/validate-events.mjs` to validate event builders against schemas.
- Fixed `NOTE_TYPES.REPOST` schema content format (json instead of empty).
- Added `NOTE_TYPES.MUTE_LIST` and `buildMuteListEvent`.
- Added `buildProfileMetadataEvent` to standardise Kind 0 creation.
- Updated `js/ui/profileModalController.js` to use `buildProfileMetadataEvent`.
- Updated `js/userBlocks.js` to use `buildMuteListEvent` for publishing mute list snapshots.
- Updated `docs/nostr-event-schemas.md` with new schemas and builders.
- Update README.md to recommend `npm ci` and include test steps.
- Update CONTRIBUTING.md with explicit development setup instructions.
- Add `.devcontainer/devcontainer.json` for reproducible Node 20 environment.
- Add audit report in `ai/reports/onboarding-20260118.md`.
- Simplified `components/login-modal.html` to center the QR code and use a "Copy Link" button instead of a large textarea.
- Updated `js/ui/loginModalController.js` to support the new DOM structure and error handling.
- Added `docs/nip46-roadmap.md` to document current state and future features.
- Defines `STORAGE_CHALLENGE` event type (Kind 22242) in `js/nostrEventSchemas.js` and docs.
- Implements `js/services/signerKeyManager.js` to derive symmetric keys from signer signatures or passphrases.
- Validates inputs and returns safe `CryptoKey` objects (AES-GCM).
Updates `content/upload-content.md` and `docs/storage-r2.md` to reflect the current manual configuration workflow for Cloudflare R2 storage.
Key changes:
- Removes deprecated instructions for generating "Admin Read & Write" or "Workers R2 Storage" automation tokens.
- Documents the new requirement to manually create a bucket and enable "Public Access" (r2.dev subdomain) in the Cloudflare Dashboard.
- Adds explicit instructions for manually configuring CORS policy via the Cloudflare Dashboard, providing the required JSON configuration.
- Aligns the "Configure bitvid" steps with the application's current UI, which requires the "Public Bucket URL" as an explicit input.
- Clarifies that "Object Read & Write" permissions are sufficient and recommended for security.
- Updated `DEFAULT_TRUSTED_MUTE_HIDE_THRESHOLD` in `config/instance-config.js` from 1 to 20.
- Updated `tests/moderation/trusted-mute-lists.test.mjs` to explicitly override the threshold to 1 for tests verifying the hide mechanism.
- Updated documentation (`docs/moderation/*.md`, `docs/instance-config.md`, `content/community-guidelines.md`) to reflect the new default and upstream examples.
- Verified that existing blurring logic in `js/feedEngine/stages.js` and `js/ui/components/VideoCard.js` handles the intermediate state (1-19 mutes) correctly.
- Add new "Setup Guide" section to `docs/storage-r2.md` detailing the dual-credential requirement (S3 Keys + Cloudflare API Token) for full automation.
- Remove unsupported "manual/S3-only" workflow documentation to prevent user confusion.
- Update `js/services/r2Service.js` error message to explicitly prompt users for an API Token when the public domain is missing, instead of suggesting manual configuration.
Removes obsolete "Migration notes" from `docs/nostr-auth.md` and
adds a regression test to `tests/state/cache-saved-profiles.test.mjs`
to confirm that the legacy `userPubKey` localStorage key is ignored
during startup. Also polyfills localStorage for the test suite.
thePR0M3TH3AN